Reproduce “AlignTree: Efficient Defense Against LLM Jailbreak Attacks” on OpenResearch

About this paper

Gil Goren, Shahar Katz, Lior Wolf

AlignTree, developed by Tel Aviv University researchers, introduces an efficient in-process defense against Large Language Model jailbreak attacks by utilizing a lightweight Random Forest classifier trained on both linear refusal activations and non-linear SVM-based signals from the LLM's hidden states. This defense achieves competitive attack success rates while maintaining minimal over-refusal of benign prompts and very low computational overhead, enabling real-time deployment.

Key insights

• Combining both linear (refusal direction) and non-linear (RBF SVM-based) signals from LLM activations provides a more comprehensive and robust detection of harmful prompts than using either signal in isolation.
• The non-linear features are particularly important for effective defense, indicating that LLM refusal behavior is complex and not entirely linear, especially for highly aligned models.
• An efficient and effective defense against LLM jailbreaks can be achieved by analyzing internal model states without modifying the base model, fine-tuning, or requiring additional LLMs or multiple inference passes.

Summary by alphaXiv.